remcos | 1f667508b2ddf652347fd73ac2e084cb004a8616cb04282e59d3ce63ab1e959d

General

Target

BG279a23_NTH_Viet_Nguyen.exe
Size

872KB
MD5

2dddaa9f2ed801d55242f73524696ef3
SHA1

dea46e90d5f26425eb6ae7aa0e36d313b02fb132
SHA256

1f667508b2ddf652347fd73ac2e084cb004a8616cb04282e59d3ce63ab1e959d
SHA512

b76a4a3830190e0e422f0b6d409a4d59f0da380132896add2ac0bace3d0a68995b4231b27ac4759179af65450b1176e89b944d5260ccb337df14778db949de48
SSDEEP

24576:3Y/WNHhinydd/ST4ndNlJx2De/EbelEs:JBwydZK4ndNrxme4eB

Score

10^/10

remcos professional rat

Malware Config

Extracted

Family

remcos

Botnet

Professional

C2

37.139.129.251:2404

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-JKTFN0
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4460 set thread context of 5072	4460	BG279a23_NTH_Viet_Nguyen.exe	88

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4460	BG279a23_NTH_Viet_Nguyen.exe
4460	BG279a23_NTH_Viet_Nguyen.exe
4460	BG279a23_NTH_Viet_Nguyen.exe
4460	BG279a23_NTH_Viet_Nguyen.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4460	BG279a23_NTH_Viet_Nguyen.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5072	BG279a23_NTH_Viet_Nguyen.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 4460 wrote to memory of 4696	4460	BG279a23_NTH_Viet_Nguyen.exe	87
PID 4460 wrote to memory of 4696	4460	BG279a23_NTH_Viet_Nguyen.exe	87
PID 4460 wrote to memory of 4696	4460	BG279a23_NTH_Viet_Nguyen.exe	87
PID 4460 wrote to memory of 2844	4460	BG279a23_NTH_Viet_Nguyen.exe	89
PID 4460 wrote to memory of 2844	4460	BG279a23_NTH_Viet_Nguyen.exe	89
PID 4460 wrote to memory of 2844	4460	BG279a23_NTH_Viet_Nguyen.exe	89
PID 4460 wrote to memory of 5072	4460	BG279a23_NTH_Viet_Nguyen.exe	88
PID 4460 wrote to memory of 5072	4460	BG279a23_NTH_Viet_Nguyen.exe	88
PID 4460 wrote to memory of 5072	4460	BG279a23_NTH_Viet_Nguyen.exe	88
PID 4460 wrote to memory of 5072	4460	BG279a23_NTH_Viet_Nguyen.exe	88
PID 4460 wrote to memory of 5072	4460	BG279a23_NTH_Viet_Nguyen.exe	88
PID 4460 wrote to memory of 5072	4460	BG279a23_NTH_Viet_Nguyen.exe	88
PID 4460 wrote to memory of 5072	4460	BG279a23_NTH_Viet_Nguyen.exe	88
PID 4460 wrote to memory of 5072	4460	BG279a23_NTH_Viet_Nguyen.exe	88
PID 4460 wrote to memory of 5072	4460	BG279a23_NTH_Viet_Nguyen.exe	88
PID 4460 wrote to memory of 5072	4460	BG279a23_NTH_Viet_Nguyen.exe	88
PID 4460 wrote to memory of 5072	4460	BG279a23_NTH_Viet_Nguyen.exe	88
PID 4460 wrote to memory of 5072	4460	BG279a23_NTH_Viet_Nguyen.exe	88

C:\Users\Admin\AppData\Local\Temp\BG279a23_NTH_Viet_Nguyen.exe
"C:\Users\Admin\AppData\Local\Temp\BG279a23_NTH_Viet_Nguyen.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4460
- C:\Users\Admin\AppData\Local\Temp\BG279a23_NTH_Viet_Nguyen.exe
  C:\Users\Admin\AppData\Local\Temp\BG279a23_NTH_Viet_Nguyen.exe
  2⤵
  PID:4696
- C:\Users\Admin\AppData\Local\Temp\BG279a23_NTH_Viet_Nguyen.exe
  C:\Users\Admin\AppData\Local\Temp\BG279a23_NTH_Viet_Nguyen.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:5072
- C:\Users\Admin\AppData\Local\Temp\BG279a23_NTH_Viet_Nguyen.exe
  C:\Users\Admin\AppData\Local\Temp\BG279a23_NTH_Viet_Nguyen.exe
  2⤵
  PID:2844

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\remcos\logs.dat

Filesize
144B

MD5
b87e356aecf890ac2edb926a302453aa

SHA1
ef5d56afde5091a90815556b56b85884cf251ffe

SHA256
e78b61c4958ec4c619f4fa94219ab77893ec360bde908ff7a1a8414cb082154c

SHA512
2d03f111d904674e42f18513a621ead0b4979855d19667f66346faedc638c2c220969f7161aec33cd81b474fb9452cc5ad51fcb2cf4e80695f7e64404a463254

Download Submit
memory/4460-12-0x0000000074EE0000-0x0000000075690000-memory.dmp

Filesize
7.7MB

Download
memory/4460-1-0x0000000000B00000-0x0000000000BE0000-memory.dmp

Filesize
896KB

Download
memory/4460-2-0x0000000074EE0000-0x0000000075690000-memory.dmp

Filesize
7.7MB

Download
memory/4460-3-0x0000000005550000-0x00000000055CE000-memory.dmp

Filesize
504KB

Download
memory/4460-4-0x0000000005610000-0x0000000005620000-memory.dmp

Filesize
64KB

Download
memory/4460-5-0x0000000005720000-0x000000000578E000-memory.dmp

Filesize
440KB

Download
memory/4460-6-0x0000000005790000-0x00000000057DC000-memory.dmp

Filesize
304KB

Download
memory/4460-7-0x0000000005DD0000-0x0000000006374000-memory.dmp

Filesize
5.6MB

Download
memory/4460-0-0x0000000074EE0000-0x0000000075690000-memory.dmp

Filesize
7.7MB

Download
memory/5072-16-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/5072-31-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/5072-14-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/5072-13-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/5072-10-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/5072-17-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/5072-18-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/5072-22-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/5072-25-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/5072-26-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/5072-8-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/5072-11-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/5072-32-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/5072-38-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/5072-39-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/5072-44-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/5072-45-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/5072-50-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/5072-52-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/5072-57-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/5072-58-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download

Analysis

Sharing